Foresight

Inspiration

Honestly this started from me being annoyed. I use Codex a lot for my hackathon builds and lately my sessions felt weirdly unpredictable I'd do something small and suddenly a big chunk of my 5-hour limit was just gone. No warning, no explanation, nothing.

Turned out this wasn't just me. I went digging and found an actual GitHub issue (openai/codex#32250) of someone's Pro quota dropping from 87% to 76% during literally one short conversation. Bunch of duplicate issues linked to it too, plus Reddit threads full of people confused about the same thing. Apparently there's also this "Ultra" reasoning mode that spins up a bunch of sub-agents with no real limit on how many, which is a big chunk of why people's usage explodes without warning.

So I kept thinking why does nothing catch this before it happens? You just find out after your quota's gone. That's basically the whole reason I built this.

What it does

You wrap your coding agent with Foresight instead of running it directly. Before anything starts, it asks GPT-5.6 to look at your task and predict how complex it actually is do you need Luna, Terra, or Sol, and at what effort level. So you're not just defaulting to Sol for something that's basically a rename.

Then while the agent's actually running, Foresight watches it every file write, every subprocess call, whether it's staying in scope or wandering off into files it shouldn't touch, whether it's trying to read something it shouldn't (like a .env file). If it crosses a line it gets killed on the spot instead of quietly burning through your budget.

One thing I want to be upfront about: there are two different modes depending on what you're wrapping, and they're not equally strong. If you're running your own Python script as the agent, Foresight can actually block a bad action before it happens. If you're wrapping something external like the real Codex CLI, it can't reach inside that process, so it watches the filesystem instead and reacts after the write already happened. I didn't want to pretend these work the same way, because they don't.

How I built it

All of it with Codex, over this week. I didn't plan the whole thing out upfront I started with just intercepting file/subprocess calls in a Python process, got that working, then kept noticing more failure modes worth catching and adding them one at a time. Hard action limits so a task can't just run forever. Detecting when it looks like a bunch of sub-agents are spawning at once. A live "you'll run out of budget in about N minutes at this rate" forecast.

At some point I also had Codex build out a benchmark suite so I wasn't just trusting my own demo ran it against 15 hand-labeled tasks (got 14/15 right on tier prediction) and 10 adversarial prompt-injection attempts (caught 9/10). It's a real published PyPI package now too (foresight-agent-guard), and I actually tested it wrapping the live Codex CLI, not a fake version of it.

Challenges I ran into

The one that actually made me stop and think: I originally built my demo around an MFA/auth task, assuming GPT-5.6 would predict a narrow scope for it. It didn't. It correctly said this touches auth/identity stuff, that's high-risk, predicted a wide scope and that broke my whole scripted demo because I'd built it expecting a different answer. Took me a second to realize the model was right and I was wrong. Had to rebuild the demo around a task that was actually narrow instead of fighting what the model was telling me.

Also hit a dumb Windows bug where certain terminal characters would crash the CLI (fixed with ASCII-safe output), and a separate bug where wrapping the real codex exec command silently failed because I forgot to import something in a callback. Found that one by actually running it against the real tool instead of trusting my own tests.

Accomplishments that we're proud of

Getting it to actually wrap the real Codex CLI and catch a real file write live that was the moment it stopped feeling like a hackathon demo and started feeling like a real tool. Also proud that it's a genuinely installable PyPI package, not just something you have to clone and configure. And that when I found my own mistakes mid-build (like the MFA thing), I wrote them up honestly instead of just quietly fixing them and pretending it always worked.

What we learned

That this quota-burn problem is real and actively being talked about right now, not something I invented to fit a hackathon category. And that being honest about what a feature can't do yet (like external mode not being able to prevent a write, only react to it) actually makes the whole project feel more trustworthy than oversell would.

What's next for Foresight

Getting deeper visibility into external processes right now the filesystem-watch mode can't see read-only file access or subprocess calls happening inside the wrapped tool. Support for other agent runtimes beyond Codex, like Claude Code. Maybe some kind of learning over time so predictions get sharper the more sessions it sees. And team-level policy stuff if people want to share budget guardrails across a group.

Built With

• cli
• click
• codex
• gpt-5.6
• nextjs
• openai-api
• pypi
• python
• rich
• typescript
• websockets